darkcloud | a05e47692520185c1d3b5b0bb72b6a4b954064d2e28af22c5dad24fb2b924743

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AW_PO.js
Size 4.8MB
Sample260730-pgwt7a1vfs
SHA256 a05e47692520185c1d3b5b0bb72b6a4b954064d2e28af22c5dad24fb2b924743
MD5 eb68387c3cddac70afe315bbb18d85c4
SHA1 38dbd2460eb0886bb773cba229ec479a0b7d6dec
SHA512 2504330f06865baa830f7f8c518717fa04fd41d47ec5b9b02e7879712f70c24dacd8938841f0beabfa03e794fcf5cff5e70f98285965fa3917708e1b86a43fc7
SSDEEP 98304:MCzJ0S1W2+Hy8y1ZNe7x5SF2OqlADbxja2RRN8/hn6aDkVc1rJSd:30g7+S81VLOqlIbVau8JPScHSd
TLSH
T1C036178142585DF5A1EDE70CE87AEA6017891143068ADF2E3379818BB71BEC7734C6DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution darkcloud persistence stealer

Malware Config

Extracted

Family

darkcloud

Version

Signatures

Family: DarkCloud
An information stealer written in Visual Basic.
stealer darkcloud

Executes dropped EXE 1 IoCs

pid	Process
124	PKPEKVVUSPVNJTHP.PIF

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1156	cmd.exe
4488	cmd.exe
2924	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5008	124	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	whoami.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PKPEKVVUSPVNJTHP.PIF
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	wscript.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1960	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1272	whoami.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 124	4180	wscript.exe	89
PID 124 wrote to memory of 1156	124	PKPEKVVUSPVNJTHP.PIF	91
PID 1156 wrote to memory of 1272	1156	cmd.exe	92
PID 124 wrote to memory of 4488	124	PKPEKVVUSPVNJTHP.PIF	93
PID 4488 wrote to memory of 1984	4488	cmd.exe	94
PID 124 wrote to memory of 2924	124	PKPEKVVUSPVNJTHP.PIF	95
PID 2924 wrote to memory of 1960	2924	cmd.exe	96

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\AW_PO.js
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Users\Admin\Documents\PKPEKVVUSPVNJTHP.PIF
  "C:\Users\Admin\Documents\PKPEKVVUSPVNJTHP.PIF" C:\Users\Admin\Documents\PKPEKVVUSPVNJTHP.ttf
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:124
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c whoami
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1156
  - - C:\Windows\SysWOW64\whoami.exe
      whoami
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1272
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /query /tn "PKPEKVVUSPVNJTHP" 2>nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4488
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /query /tn "PKPEKVVUSPVNJTHP"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1984
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /sc minute /mo 15 /tn "PKPEKVVUSPVNJTHP" /tr "cmd /c \"C:\Users\Admin\Documents\PHTJNVPSUVVKEPKP.url\"" /ru "dlawbtbf\admin" /f /it
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /sc minute /mo 15 /tn "PKPEKVVUSPVNJTHP" /tr "cmd /c \"C:\Users\Admin\Documents\PHTJNVPSUVVKEPKP.url\"" /ru "dlawbtbf\admin" /f /it
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 124 -s 368
    3⤵
    - Program crash
    PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 124 -ip 124
1⤵
PID:5012

C:\Windows\system32\cmd.exe
cmd
1⤵
PID:4584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PKPEKVVUSPVNJTHP.PIF

Path C:\Users\Admin\Documents\PKPEKVVUSPVNJTHP.PIF
Size 499KB
SHA256 d447a06cba8d3dbe80e09d73dd64576836b258961ee0d3ba56cf26cea7962b49
MD5 7675b38aabebc8427171447edd484b5b
SHA1 145c72f8acdcd366869f955dffd000d3bc146b6e
SHA512 bc9bddbee59f165742a3203f9e2ba9de409e66de6334cb352cded84cce3e1074dbd0ac17b29e58c8729906848b64d1486fb8c848ca15422127b2baeb4c5e5dbe
SSDEEP 12288:HW7YOPcqPqvopYJNWGIbK8AJYlqWuSr7B/Uj:HW7RPcqPqvopYJYK8AyldpUj
TLSH
T176B43AC4BACB08F1E2A355B0C49BDB7F96349A050022D5BAFF5CBD59EC33746092725A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PKPEKVVUSPVNJTHP.ttf

Path C:\Users\Admin\Documents\PKPEKVVUSPVNJTHP.ttf
Size 863KB
SHA256 02967e7df8a67bb315fef7588622abf4b11545cb10c4c79af6dc57d6216e8d04
MD5 b15cef0d15904bbdc72ca13c108ed822
SHA1 1bc97125de225bd2bc1e24d0a0386ea46a07343b
SHA512 fcad8c2586a2a8c172724e2d4c481f18ccca82d05bc13688a8223ef5792bb86b508bf6cf9a45e51cc5f362c1f19b9b1b06ec8740ae3c1f39673e715c6781448d
SSDEEP 24576:pezvvlo5bPUGhizWm19KmhTitgoywQRyQ:p9zTiSm1sKTitgoywQRyQ
TLSH
T13B157D7B55DF2CA9085321E0EC194B8370AFC9E44ACB4CB96E41F629A14747CA7DCB2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PKPEKVVUSPVNJTHP.ubf

Path C:\Users\Admin\Documents\PKPEKVVUSPVNJTHP.ubf
Size 2B
SHA256 98010bd9270f9b100b6214a21754fd33bdc8d41b2bc9f9dd16ff54d3c34ffd71
MD5 642e92efb79421734881b53e1e1b18b6
SHA1 64e095fe763fc62418378753f9402623bea9e227
SHA512 40a5b90ccb302b50ff2610f3231fabf263e0ea3a23372035cf856ea4b27951da3e1dbf05f0856c0ffa01bc57f256a418fe213d99df55b90e3ecc3da6042dc032
MD5 SHA1 SHA512

Submit Download

memory/124-35-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/124-30-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/124-24-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/124-23-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/124-29-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/124-37-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/124-38-0x0000000002BA0000-0x0000000002C2B000-memory.dmp

Download

memory/124-36-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/124-34-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/124-33-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/124-32-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/124-10-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/124-31-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/124-20-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/124-28-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/124-27-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/124-26-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/124-25-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/124-22-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/124-21-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/124-40-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/124-19-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/124-18-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/124-17-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/124-16-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/124-12-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/124-11-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads